dhkatz
d5cd2be5d0
## Age verification with Didit A new provider (`apps/api/src/age/didit.ts`) behind the existing vendor-neutral age interface. A person verifies once with an ID document, a passive liveness check and a face match; after that, all their linked IMVU accounts count as adult. The hub keeps only "over 18": never the document, photo or birth date. - Webhooks are checked against Didit's signatures (the raw body or V2, with `-Previous` during secret rotation), and old ones are rejected. If the webhook has no decision, the hub fetches it from Didit. - A later answer replaces an earlier one. An approval that's taken back (say, after a manual review) becomes `revoked`. A check still in review stays pending. - Limits, for every provider: one unfinished check per person (starting again resumes it), at most 3 checks in 30 days, none once verified, and a monthly cap (`DIDIT_MONTHLY_LIMIT`, default 30: since 2026-11-01, Didit's free plan is $10 of credit a month, and a check costs $0.30). - People are only ever sent back to the hub's website. - The Account page gets an Age Verification card. - Configuration: `AGE_PROVIDERS=imvu,didit`, `DIDIT_API_KEY`, `DIDIT_WORKFLOW_ID`, `DIDIT_WEBHOOK_SECRET`. The webhook is `<API_URL>/api/v1/age/webhook/didit`. ## Closed registration Registration is open or closed. It's an admin's setting in the console, with its default from `REGISTRATION`. - When it's closed, new accounts can only sign in until a moderator approves them, or declines them (which deletes the account). - The website shows people who are waiting a waiting page, and the API treats them as signed out everywhere but `/me`. - The console gets a Waiting count, a Waiting for approval filter, Approve and Decline on a person's page, and a Registration setting. - The migration adds `user.approved` (existing accounts stay approved) and `hub_setting`. ## Testing - New tests cover Didit (with a fake Didit server), the limits, revocation, return addresses and registration. - `bun run test`: 35 pass. `bun run check-types` passes. - Checked locally: the account, waiting, sign-up and console pages render. - Not run against Didit itself yet. The sandbox workflow "T5DE Age Check" is published, and the next step is a real webhook once this is on staging. 🤖 Generated with [Claude Code](https://claude.com/claude-code) ## Age verification with Didit A new provider (`apps/api/src/age/didit.ts`) behind the existing vendor-neutral age interface. A person verifies once with an ID document, a passive liveness check and a face match; after that, all their linked IMVU accounts count as adult. The hub keeps only "over 18": never the document, photo or birth date. - Webhooks are checked against Didit's signatures (the raw body or V2, with `-Previous` during secret rotation), and old ones are rejected. If the webhook has no decision, the hub fetches it from Didit. - A later answer replaces an earlier one. An approval that's taken back (say, after a manual review) becomes `revoked`. A check still in review stays pending. - Limits, for every provider: one unfinished check per person (starting again resumes it), at most 3 checks in 30 days, none once verified, and a monthly cap (`DIDIT_MONTHLY_LIMIT`, default 30: since 2026-11-01, Didit's free plan is $10 of credit a month, and a check costs $0.30). - People are only ever sent back to the hub's website. - The Account page gets an Age Verification card. - Configuration: `AGE_PROVIDERS=imvu,didit`, `DIDIT_API_KEY`, `DIDIT_WORKFLOW_ID`, `DIDIT_WEBHOOK_SECRET`. The webhook is `<API_URL>/api/v1/age/webhook/didit`. ## Closed registration Registration is open or closed. It's an admin's setting in the console, with its default from `REGISTRATION`. - When it's closed, new accounts can only sign in until a moderator approves them, or declines them (which deletes the account). - The website shows people who are waiting a waiting page, and the API treats them as signed out everywhere but `/me`. - The console gets a Waiting count, a Waiting for approval filter, Approve and Decline on a person's page, and a Registration setting. - The migration adds `user.approved` (existing accounts stay approved) and `hub_setting`. ## Testing - New tests cover Didit (with a fake Didit server), the limits, revocation, return addresses and registration. - `bun run test`: 35 pass. `bun run check-types` passes. - Checked locally: the account, waiting, sign-up and console pages render. - Not run against Didit itself yet. The sandbox workflow "T5DE Age Check" is published, and the next step is a real webhook once this is on staging. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: dhkatz <[email protected]>
69 lines
3.0 KiB
TypeScript
69 lines
3.0 KiB
TypeScript
import { ActionForm, SubmitButton } from "@/components/forms";
|
|
import { Tag } from "@/components/status";
|
|
import { TimeAgo } from "@/components/time";
|
|
import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
|
|
import type { AgeInfo } from "@/lib/api";
|
|
import { startAgeCheck } from "./actions";
|
|
|
|
/** The person's own age check (an ID document, say), which covers all their IMVU accounts. */
|
|
export function AgeCard({ age, back }: { age: AgeInfo; back: boolean }) {
|
|
const ways = age.providers.filter((p) => p.scope === "person");
|
|
if (ways.length === 0) return null;
|
|
const now = Date.now();
|
|
const verified = age.checks.find(
|
|
(c) => c.status === "complete" && c.overEighteen && (!c.expiresAt || new Date(c.expiresAt).getTime() > now),
|
|
);
|
|
const latest = age.checks[0];
|
|
const pending = latest?.status === "pending" ? latest : undefined;
|
|
const vendorOf = (id: string) => age.providers.find((p) => p.id === id)?.vendor ?? id;
|
|
|
|
return (
|
|
<Card>
|
|
<CardHeader>
|
|
<CardTitle>Age Verification</CardTitle>
|
|
</CardHeader>
|
|
<CardContent className="space-y-4 text-sm">
|
|
{verified ? (
|
|
<p className="flex flex-wrap items-center gap-2">
|
|
<Tag tone="adult">Age verified</Tag>
|
|
<span className="text-muted-foreground">
|
|
with {vendorOf(verified.provider)} <TimeAgo iso={verified.checkedAt ?? verified.createdAt} />. All your
|
|
IMVU accounts count as adult.
|
|
</span>
|
|
</p>
|
|
) : (
|
|
<>
|
|
{pending ? (
|
|
<p>
|
|
{back
|
|
? "Thanks. Your check is being processed; this page shows the result when it's done."
|
|
: "Your check isn't finished yet."}
|
|
</p>
|
|
) : latest?.status === "complete" && !latest.overEighteen ? (
|
|
<p>Your last check found you're under 18.</p>
|
|
) : latest?.status === "failed" || latest?.status === "revoked" ? (
|
|
<p>Your last check didn't pass. You can try again.</p>
|
|
) : (
|
|
<p className="text-muted-foreground">
|
|
Verify your age once to count as adult on all your IMVU accounts, not only those IMVU has age verified.
|
|
</p>
|
|
)}
|
|
{ways.map((p) => (
|
|
<ActionForm key={p.id} action={startAgeCheck} fields={{ provider: p.id }}>
|
|
<div className="space-y-2">
|
|
<SubmitButton variant={pending && pending.provider !== p.id ? "outline" : "default"} pendingLabel="Starting…">
|
|
{pending?.provider === p.id ? "Continue check" : `Verify with ${p.label}`}
|
|
</SubmitButton>
|
|
<p className="text-xs text-muted-foreground">
|
|
Done by {p.vendor}. T5DE only keeps whether you're over 18, never your ID, photo or birth date.
|
|
</p>
|
|
</div>
|
|
</ActionForm>
|
|
))}
|
|
</>
|
|
)}
|
|
</CardContent>
|
|
</Card>
|
|
);
|
|
}
|